It may be a stand-alone device or integrated into other network components.” In other words, a WAF can be a virtual or physical appliance that prevents vulnerabilities in web applications from being exploited by outside threats. This functionality can be implemented in software or hardware, running in an appliance device, or in a typical server running a common operating system. The OWASP provides a broad technical definition for a WAF as “a security solution on the web application level which - from a technical point of view - does not depend on the application itself.” According to the PCI DSS Information Supplement for requirement 6.6, a WAF is defined as “a security policy enforcement point positioned between a web application and the client endpoint. It is deployed in front of web applications and analyzes bi-directional web-based (HTTP) traffic - detecting and blocking anything malicious. Description Ī web application firewall is a special type of application firewall that applies specifically to web applications. According to CISO Magazine, the WAF market was expected to grow to $5.48 billion by 2022. With the development of the Payment Card Industry Data Security Standard (PCI DSS), a standardization of control over cardholder data, security has become more regulated in this sector. Since then, the market has continued to grow and evolve, especially focusing on credit card fraud prevention. This list would become the industry standard for web application security compliance. In 2003, they expanded and standardized rules through the Open Web Application Security Project’s (OWASP) Top 10 List, an annual ranking for web security vulnerabilities. They finalized a core rule set for protecting web applications, based on OASIS Web Application Security Technical Committee’s (WAS TC) vulnerability work. In 2002, the open source project ModSecurity was formed in order to make WAF technology more accessible. Other early WAF products, from Kavado and Gilian technologies, were available in the market at the same time, trying to solve the increasing amount of attacks on web applications in the late 90s.

Security information and event management (SIEM)ĭedicated web application firewalls entered the market in the late 1990s during a time when web server attacks were becoming more prevalent.Īn early version of WAF was developed by Perfecto Technologies with its AppShield product, which focused on the e-commerce market and protected against illegal web page character entries.Host-based intrusion detection system (HIDS).

Application firewall